December 2025 - dev

Thoughts on interface modes / multiple guest addresses
by David Gibson 16 Jan '26

16 Jan '26

Hi Jon, As discussed on the call yesterday, I've written up my thoughts on what a bunch of the address semantics should be. Turns out I'd already done some of this at: https://pad.passt.top/p/InterfaceMode I've now updated to cover some more things, and considering the possibility of multiple guest addresses.. Turns out etherpad doesn't really do tables, so it's two sections for the two suggested modes, with matching subheadings. It's still very much a draft so: * It might be unclear - please ask me to clarify anything * It will have some mistakes - make your case if you think my proposed semantics don't make sense * It will be incomplete - feel free to add extra subheadings for anything you -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

3 14

PASST/PASST Dynamic Networking Features
by Jon Maloy 16 Jan '26

16 Jan '26

Hi all, Before going further with the implementation, I spent some time to understand the contents and implications of the various bugs/texts we have in this area. I then tried, to the best of my ability, to compile them into user stories, which I think might be a good format for our users to evaluate this. https://pad.passt.top/p/NetlinkMonitor Please have a look and give feedback! ///jon

2 1

[PATCH] conf, pasta: Add --no-tap option
by Yumei Huang 14 Jan '26

14 Jan '26

This patch introduces a mode where we only forward loopback connections and traffic between two namespaces (via the loopback interface, 'lo'), without a tap device. With this, podman can support forwarding ::1 in custom networks when using rootlesskit for forwarding ports. In --no-tap mode, --host-lo-to-ns-lo, --no-icmp and --no-ra is automatically enabled. Options requiring a tap device (--ns-ifname, --ns-mac-addr, --config-net, --outbound-if4/6) are rejected. Link: https://bugs.passt.top/show_bug.cgi?id=149 Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- conf.c | 56 +++++++++++++++++++++++++++++++++++++++++--------------- fwd.c | 3 +++ passt.1 | 5 +++++ passt.h | 2 ++ pasta.c | 3 +++ tap.c | 11 +++++++---- 6 files changed, 61 insertions(+), 19 deletions(-) diff --git a/conf.c b/conf.c index 84ae12b..353d0a5 100644 --- a/conf.c +++ b/conf.c @@ -1049,7 +1049,8 @@ pasta_opts: " --no-copy-addrs DEPRECATED:\n" " Don't copy all addresses to namespace\n" " --ns-mac-addr ADDR Set MAC address on tap interface\n" - " --no-splice Disable inbound socket splicing\n"); + " --no-splice Disable inbound socket splicing\n" + " --no-tap Don't create tap device\n"); passt_exit(status); } @@ -1451,6 +1452,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, {"no-splice", no_argument, &c->no_splice, 1 }, + {"no-tap", no_argument, &c->no_tap, 1 }, {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, {"ipv4-only", no_argument, NULL, '4' }, @@ -1947,8 +1949,11 @@ void conf(struct ctx *c, int argc, char **argv) } } while (name != -1); - if (c->mode != MODE_PASTA) + if (c->mode != MODE_PASTA) { c->no_splice = 1; + if (c->no_tap) + die("--no-tap is for pasta mode only"); + } if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { if (copy_routes_opt) @@ -1957,6 +1962,25 @@ void conf(struct ctx *c, int argc, char **argv) die("--no-copy-addrs needs --config-net"); } + if (c->mode == MODE_PASTA && c->no_tap) { + if (c->no_splice) + die("--no-tap is incompatible with --no-splice"); + if (*c->ip4.ifname_out || *c->ip6.ifname_out) + die("--no-tap is incompatible with --outbound-if4/6"); + if (*c->pasta_ifn) + die("--no-tap is incompatible with --ns-ifname"); + if (*c->guest_mac) + die("--no-tap is incompatible with --ns-mac-addr"); + if (c->pasta_conf_ns) + die("--no-tap is incompatible with --config-net"); + + c->host_lo_to_ns_lo = 1; + c->no_icmp = 1; + c->no_ra = 1; + c->no_dns = 1; + c->no_dns_search = 1; + } + if (!ifi4 && *c->ip4.ifname_out) ifi4 = if_nametoindex(c->ip4.ifname_out); @@ -1980,9 +2004,9 @@ void conf(struct ctx *c, int argc, char **argv) log_conf_parsed = true; /* Stop printing everything */ nl_sock_init(c, false); - if (!v6_only) + if (!v6_only && !c->no_tap) c->ifi4 = conf_ip4(ifi4, &c->ip4); - if (!v4_only) + if (!v4_only && !c->no_tap) c->ifi6 = conf_ip6(ifi6, &c->ip6); if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { @@ -1998,30 +2022,32 @@ void conf(struct ctx *c, int argc, char **argv) (*c->ip6.ifname_out && !c->ifi6)) die("External interface not usable"); - if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn) { + if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn && !c->no_tap) { strncpy(c->pasta_ifn, pasta_default_ifn, sizeof(c->pasta_ifn) - 1); } if (!c->ifi4 && !v6_only) { - info("IPv4: no external interface as template, use local mode"); - - conf_ip4_local(&c->ip4); + if (!c->no_tap) { + info("IPv4: no external interface as template, use local mode"); + conf_ip4_local(&c->ip4); + } c->ifi4 = -1; } if (!c->ifi6 && !v4_only) { - info("IPv6: no external interface as template, use local mode"); - - conf_ip6_local(&c->ip6); + if (!c->no_tap) { + info("IPv6: no external interface as template, use local mode"); + conf_ip6_local(&c->ip6); + } c->ifi6 = -1; } - if (c->ifi4 && !no_map_gw && + if (c->ifi4 > 0 && !no_map_gw && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) c->ip4.map_host_loopback = c->ip4.guest_gw; - if (c->ifi6 && !no_map_gw && + if (c->ifi6 > 0 && !no_map_gw && IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) c->ip6.map_host_loopback = c->ip6.guest_gw; @@ -2116,10 +2142,10 @@ void conf(struct ctx *c, int argc, char **argv) conf_ports(c, name, optarg, &c->udp.fwd_out); } while (name != -1); - if (!c->ifi4) + if (c->ifi4 <= 0) c->no_dhcp = 1; - if (!c->ifi6) { + if (c->ifi6 <= 0) { c->no_ndp = 1; c->no_dhcpv6 = 1; } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { diff --git a/fwd.c b/fwd.c index 44a0e10..2f4a89a 100644 --- a/fwd.c +++ b/fwd.c @@ -780,6 +780,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, return PIF_SPLICE; } + if (c->no_tap) + return PIF_NONE; + if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { if (inany_v4(&ini->eaddr)) { if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) diff --git a/passt.1 b/passt.1 index db0d662..2d643f7 100644 --- a/passt.1 +++ b/passt.1 @@ -755,6 +755,11 @@ Default is to let the tap driver build a pseudorandom hardware address. Disable the bypass path for inbound, local traffic. See the section \fBHandling of local traffic in pasta\fR in the \fBNOTES\fR for more details. +.TP +.BR \-\-no-tap +Do not create a tap device in the namespace. In this mode, only local loopback +traffic between namespaces is forwarded using splice. + .SH EXAMPLES .SS \fBpasta diff --git a/passt.h b/passt.h index 79d01dd..0c1ec4c 100644 --- a/passt.h +++ b/passt.h @@ -200,6 +200,7 @@ struct ip6_ctx { * @no_ndp: Disable NDP handler altogether * @no_ra: Disable router advertisements * @no_splice: Disable socket splicing for inbound traffic + * @no_tap: Do not create tap device * @host_lo_to_ns_lo: Map host loopback addresses to ns loopback addresses * @freebind: Allow binding of non-local addresses for forwarding * @low_wmem: Low probed net.core.wmem_max @@ -277,6 +278,7 @@ struct ctx { int no_ndp; int no_ra; int no_splice; + int no_tap; int host_lo_to_ns_lo; int freebind; diff --git a/pasta.c b/pasta.c index 0ddd6b0..3510ec5 100644 --- a/pasta.c +++ b/pasta.c @@ -316,6 +316,9 @@ void pasta_ns_conf(struct ctx *c) die("Couldn't bring up loopback interface in namespace: %s", strerror_(-rc)); + if (c->no_tap) + return; + /* Get or set MAC in target namespace */ if (MAC_IS_ZERO(c->guest_mac)) nl_link_get_mac(nl_sock_ns, c->pasta_ifi, c->guest_mac); diff --git a/tap.c b/tap.c index 9d1344b..9b4eedc 100644 --- a/tap.c +++ b/tap.c @@ -1491,13 +1491,16 @@ static int tap_ns_tun(void *arg) */ static void tap_sock_tun_init(struct ctx *c) { - NS_CALL(tap_ns_tun, c); - if (c->fd_tap == -1) - die("Failed to set up tap device in namespace"); + if (!c->no_tap) { + NS_CALL(tap_ns_tun, c); + if (c->fd_tap == -1) + die("Failed to set up tap device in namespace"); + } pasta_ns_conf(c); - tap_start_connection(c); + if (!c->no_tap) + tap_start_connection(c); } /** -- 2.49.0

4 23

[PATCH 0/7] flow: Introduce flow_epoll_set() to centralize epoll operations
by Laurent Vivier 27 Dec '25

27 Dec '25

Currently, each protocol handler (TCP, TCP splice, ICMP/ping, UDP) has its own code to add or modify file descriptors in epoll. This leads to duplicated boilerplate across icmp.c, tcp.c, tcp_splice.c, and udp_flow.c, with each setting up epoll_ref unions and calling epoll_ctl() with flow-type-specific details. This series introduces flow_epoll_set() in flow.c to handle epoll operations for all flow types in a unified way. The function evolves across the series, progressively absorbing more responsibilities: 1. Initial version takes explicit fd, events, and ctx parameters 2. Events computation is moved inside the function by relocating tcp_conn_epoll_events() and tcp_splice_conn_epoll_events() into flow.c 3. The ctx parameter is removed by using epoll_id_to_fd[EPOLLFD_ID_DEFAULT] directly for new flows 4. The fd parameter is removed by having the function extract the file descriptor from the flow structure based on the epoll type The final API is simply: int flow_epoll_set(enum epoll_type type, const struct flow_common *f, unsigned int sidei); This centralized approach will be essential for queue pair migration in the upcoming multithreading work, where flows need to be moved between different epoll instances owned by different threads. Preparatory patches: - Patch 1 fixes EPOLL_TYPE_TCP_TIMER to use the actual timer fd - Patch 2 refactors udp_flow_sock() to assign the socket internally - Patch 3 refactors tcp_splice_conn_epoll_events() to per-side computation Core series: - Patch 4 introduces the initial flow_epoll_set() function - Patch 5 removes the ctx parameter - Patch 6 moves event computation inside flow_epoll_set() - Patch 7 removes the fd parameter, completing the refactoring Laurent Vivier (7): tcp: Update EPOLL_TYPE_TCP_TIMER fd udp_flow: Assign socket to flow inside udp_flow_sock() tcp_splice: Refactor tcp_splice_conn_epoll_events() to per-side computation flow: Introduce flow_epoll_set() to centralize epoll operations flow: Use epoll_id_to_fd[EPOLLFD_ID_DEFAULT] in flow_epollid_set() flow: Compute epoll events inside flow_epoll_set() flow: Have flow_epoll_set() retrieve file descriptor from flow structure flow.c | 158 +++++++++++++++++++++++++++++++++++++++++++++++++++ flow.h | 4 ++ icmp.c | 8 +-- tcp.c | 68 +++------------------- tcp_splice.c | 77 +++++-------------------- udp_flow.c | 17 ++---- 6 files changed, 190 insertions(+), 142 deletions(-) -- 2.51.1

2 14

[PATCH] selinux: Enable read and watch permissions on netns directory as well
by Stefano Brivio 24 Dec '25

24 Dec '25

With commit 7aeda16a7818 ("selinux: Transition to pasta_t in containers"), we need to make sure that pasta can access the target namespace directory passed by Podman, and, in a general case, we have all the permissions we need. But if we now start a container without the Podman changes referenced by commit fd1bcc30af07 ("selinux: add container_var_run_t type transition"), or with them, but with the container being created before those and without a reboot in between, we'll additionally need 'read' and 'watch' permissions on user_tmp_t directory as well, as user_tmp_t is still the (inconsistent) context of the namespace entry. Otherwise, on a container start/restart, we'll get SELinux denials: type=AVC msg=audit(1766451401.296:184): avc: denied { read } for pid=2159 comm="pasta.avx2" name="netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:obje ct_r:user_tmp_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1766451401.298:185): avc: denied { watch } for pid=2159 comm="pasta.avx2" path="/run/user/1001/netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=1 This can be reproduced quite simply: $ podman create -q --name hello hello 6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770 [upgrade passt's SELinux policy to a version including 7aeda16a7818] $ podman start hello Error: unable to start container "6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770": pasta failed with exit code 1: netns dir open: Permission denied, exiting Reported-by: Tuomo Soini <tis(a)foobar.fi> Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 95fe42a..3eb58f6 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -149,7 +149,7 @@ allow pasta_t root_t:dir mounton; manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t) files_pid_filetrans(pasta_t, pasta_pid_t, file) -allow pasta_t user_tmp_t:dir { add_name remove_name search write }; +allow pasta_t user_tmp_t:dir { add_name read remove_name search watch write }; allow pasta_t user_tmp_t:fifo_file append; allow pasta_t user_tmp_t:file { create open write }; allow pasta_t user_tmp_t:sock_file { create unlink }; -- 2.43.0

2 2

passt: new version 2025_12_23.2ba9fd5 available
by Stefano Brivio 24 Dec '25

24 Dec '25

The new version with tag 2025_12_23.2ba9fd5 includes the following changes: 2ba9fd5 tcp: Update EPOLL_TYPE_TCP_TIMER fd 6292845 udp: Rename udp_sock_init() to udp_listen() with small cleanups 0f4ba61 tcp: Combine tcp_sock_init_one() and tcp_sock_init() into tcp_listen() 75dcbc3 pasta: Warn, disable matching IP version if not supported, in local mode d2c5133 selinux: Enable read and watch permissions on netns directory as well https://passt.top/passt/log/?qt=range&q=2025_12_15.b40f5cd..2025_12_23.2ba9… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9946709/ permanent mirror: https://passt.top/builds/copr/0^20251223.g2ba9fd5/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g2ba9fd5-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_2ba9fd5-1_all.deb -- Stefano

1 0

[PATCH] tcp: Update EPOLL_TYPE_TCP_TIMER fd
by Laurent Vivier 24 Dec '25

24 Dec '25

For consistency with other epoll events, set the fd field to the file descriptor actually added by epoll_ctl() (conn->timer), rather than conn->sock. This is a no-op change as ref.fd is not currently used in tcp_timer_handler(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index b179e3991236..fade42b0c4d9 100644 --- a/tcp.c +++ b/tcp.c @@ -554,7 +554,7 @@ static int tcp_epoll_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer != -1) { union epoll_ref ref_t = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, + .fd = conn->timer, .flow = FLOW_IDX(conn) }; struct epoll_event ev_t = { .data.u64 = ref_t.u64, .events = EPOLLIN | EPOLLET }; @@ -582,7 +582,7 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer == -1) { union epoll_ref ref = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, + .fd = conn->timer, .flow = FLOW_IDX(conn) }; struct epoll_event ev = { .data.u64 = ref.u64, .events = EPOLLIN | EPOLLET }; -- 2.51.1

2 1

[PATCH 0/2] Cleanups to listening socket init functions
by David Gibson 24 Dec '25

24 Dec '25

Another small preliminary for flexible forwarding. This makes some cleanups to the functions which create listening sockets for TCP and UDP. No functional changes. David Gibson (2): tcp: Combine tcp_sock_init_one() and tcp_sock_init() into tcp_listen() udp: Rename udp_sock_init() to udp_listen() with small cleanups conf.c | 4 +-- tcp.c | 94 +++++++++++++++++++++------------------------------------- tcp.h | 6 ++-- udp.c | 32 +++++++++----------- udp.h | 6 ++-- 5 files changed, 56 insertions(+), 86 deletions(-) -- 2.52.0

2 3

[PATCH] pasta: Warn, disable matching IP version if not supported, in local mode
by Stefano Brivio 23 Dec '25

23 Dec '25

...instead of exiting, but only if local mode is enabled, that is, if we couldn't find a template interface or if the user didn't specify one. With IPv4, we always try to set or copy an address, so check if that fails. With IPv6, in local mode, we rely on the link-local address that's automatically generated inside the target namespace, and only fail later, as we try to set up routes. Check if that fails, instead. Otherwise, we'll fail to start if IPv6 support is not built in or disabled by the kernel ("ipv6.disable=1" on the command line), because, in that case, we'll try to enable local mode by default, and then fail to set any address or route. It would probably be more elegant to check for IP version support in conf_ip4_local() and conf_ip6_local(), and not even try to enable connectivity for unsupported versions, but it looks less robust than trying and failing, as there might be other ways to disable a given IP version. Note that there's currently no way to disable IPv4 support on the kernel command line, that is, there's no such thing as an ipv4.disable boot parameter. But I guess that's due to be eventually implemented, one day, so let's cover that case as well, also for consistency. Reported-by: Iyan <iyanmv(a)gmail.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2424192 Fixes: 4ddd59bc6085 ("conf: Separate local mode for each IP version, don't enable disabled IP version") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- pasta.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/pasta.c b/pasta.c index c307b8a..0ddd6b0 100644 --- a/pasta.c +++ b/pasta.c @@ -348,6 +348,12 @@ void pasta_ns_conf(struct ctx *c) AF_INET); } + if (c->ifi4 == -1 && rc == -ENOTSUP) { + warn("IPv4 not supported, disabling"); + c->ifi4 = 0; + goto ipv4_done; + } + if (rc < 0) { die("Couldn't set IPv4 address(es) in namespace: %s", strerror_(-rc)); @@ -367,6 +373,7 @@ void pasta_ns_conf(struct ctx *c) strerror_(-rc)); } } +ipv4_done: if (c->ifi6) { rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, @@ -413,12 +420,19 @@ void pasta_ns_conf(struct ctx *c) AF_INET6); } + if (c->ifi6 == -1 && rc == -ENOTSUP) { + warn("IPv6 not supported, disabling"); + c->ifi6 = 0; + goto ipv6_done; + } + if (rc < 0) { die("Couldn't set IPv6 route(s) in guest: %s", strerror_(-rc)); } } } +ipv6_done: proto_update_l2_buf(c->guest_mac); } -- 2.43.0

1 0

[PATCH v3 0/2] conf: Support CIDR notation for -a/--address option
by Jon Maloy 21 Dec '25

21 Dec '25

conf: Support CIDR notation for -a/--address option --- v3: Fixes after feedback from Laurent, David and Stefano Notably, updated man page for the -a option Jon Maloy (2): conf: Support CIDR notation for -a/--address option doc: Document CIDR notation support for -a/--address option conf.c | 94 ++++++++++++++++++++++++++++++++++++++++++++++++--------- passt.1 | 10 ++++-- 2 files changed, 87 insertions(+), 17 deletions(-) -- 2.52.0

2 2